Adobe patches 11 ColdFusion vulnerabilities including RCE
Adobe released patches for 11 vulnerabilities in ColdFusion 2023 and 2025, including flaws enabling remote code execution, privilege escalation, and data confidentiality breaches.
The French CERT (CERT-FR) has published an advisory regarding multiple security vulnerabilities discovered in Adobe ColdFusion. The flaws affect ColdFusion 2023 versions prior to Update 21 and ColdFusion 2025 versions prior to Update 10. The vulnerabilities encompass a range of attack vectors including remote arbitrary code execution, server-side request forgery (SSRF), cross-site scripting (XSS), privilege escalation, and confidentiality breaches.
Adobe addressed these issues in security bulletin APSB26-68 released on June 30, 2026. The advisory references eleven distinct CVE identifiers spanning from CVE-2026-48276 through CVE-2026-48316. Organizations running affected versions of ColdFusion are advised to apply the available security updates immediately.
ColdFusion remains a widely deployed application server platform, particularly in enterprise environments running legacy web applications. The combination of remote code execution capabilities and the server-side nature of these vulnerabilities makes prompt patching critical for organizations using the platform.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by ColdFusion Server Process
Detects command interpreters or system utilities spawned as children of the ColdFusion service process, indicative of exploitation of a ColdFusion RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by ColdFusion Server Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- \coldfusion
- \jrun.exe
- \runtime\bin\coldfusion.exe
suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \whoami.exe
- \net.exe
- \certutil.exe
- \mshta.exe
condition: selection and suspicious_child
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks configured to run
from the ColdFusion service account
- Backup or monitoring agents that shell out from the ColdFusion process context
level: high
tags:
- attack.t1190
- attack.t1059
id: e3a93941-8c1c-50bc-aacf-5081a26e6044
status: experimental
author: Vorant
Webshell-like File Write by ColdFusion Process into Web Root
Detects the ColdFusion server process writing new script files (cfm, cfc, jsp) into web-accessible directories, consistent with webshell deployment following exploitation of a ColdFusion RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell-like File Write by ColdFusion Process into Web Root
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- \coldfusion
- \jrun.exe
TargetFilename|endswith:
- .cfm
- .cfc
- .jsp
- .jspx
filter:
TargetFilename|contains:
- \WEB-INF\
- \cache\
condition: selection and not filter
falsepositives:
- Legitimate application deployment or update processes that write .cfm/.cfc files
during normal operation
- Automated CI/CD pipelines pushing ColdFusion application code to the server
level: medium
tags:
- attack.t1505.003
- attack.t1190
id: f110d27e-867c-5b79-afc9-cb0a70802f31
status: experimental
author: Vorant
ColdFusion Process Initiating Outbound Network Connection to Uncommon Port
Detects the ColdFusion server process making outbound network connections, which may indicate SSRF exploitation or a reverse shell/C2 callback following exploitation of a ColdFusion vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Initiating Outbound Network Connection to Uncommon Port
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- \coldfusion
- \jrun.exe
Initiated: 'true'
filter:
DestinationPort:
- 80
- 443
- 1433
- 3306
- 389
- 636
condition: selection and not filter
falsepositives:
- ColdFusion legitimately calling out to external web services, databases, or LDAP
servers configured by the application
- Scheduled tasks within ColdFusion that fetch remote data as part of normal business
logic
level: medium
tags:
- attack.t1071
- attack.t1190
id: 132ada0d-6df9-5b52-b7ec-d872d9502b33
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0821
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free